I think my server has been hacked

[dfutura]

I cant login to plesk: the connection has been closed. I have found a lot of lines like this in messages:

Aug 1 07:32:15 bcl00761 sshd(pam_unix)[25672]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=61.185.220.46 user=root

Aug 1 07:32:02 bcl00761 sshd(pam_unix)[25668]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=61.185.220.46 user=apache

Aug 1 07:31:22 bcl00761 sshd(pam_unix)[25651]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=61.185.220.46 user=ftp

Aug 1 07:30:30 bcl00761 sshd(pam_unix)[25635]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=61.185.220.46 user=mysql.

How Can i change plesk pass from ssh.

 

[sieb@]

That's just some script kiddy (or zombie) trying to do a dictionary attack. I get **** like that in my logs everyday. "Authentication Failure" means they didn't get logged on.

As for your password:

https://forum.plesk.com/showthread.php?s=&threadid=17996&highlight=reset+password

or

https://forum.plesk.com/showthread.php?s=&threadid=17279&highlight=reset+password